Gstreamer
CVE-2024-47596
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects the network-based attack vector with no authentication required and high availability impact, but this may overstate the real-world risk. The EPSS score of 0.08% (23rd percentile) indicates very low observed exploitation activity, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. While the attack complexity is low (AC:L) and can be triggered remotely (AV:N), the impact is limited to denial of service or information disclosure without integrity compromise. The vulnerability requires an attacker to deliver malicious media files that victims must process, reducing the attack surface compared to always-exposed network services. Given the patch availability and low exploitation probability, this represents a moderate priority for most organizations rather than a critical emergency. |
| Exploit ScenarioDerived | An attacker creates a malicious QuickTime video file with crafted SVQ3 codec data that specifies an oversized seqh_size value and hosts it on a website or sends it via email. When a victim opens this file in any application using GStreamer for media playback (such as media players, browsers with GStreamer backends, or video processing tools), the vulnerable parser attempts to read beyond the allocated buffer, potentially exposing up to 4GB of process memory or causing the application to crash. The GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/ provides technical details that could facilitate exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An out-of-bounds read vulnerability in GStreamer's QuickTime demuxer allows remote attackers to read up to 4GB of process memory or crash the application when processing malformed media files. The vulnerability affects all GStreamer versions prior to 1.24.10 and can be triggered without authentication by supplying specially crafted QuickTime files. While not currently in CISA's Known Exploited Vulnerabilities catalog, the low EPSS score of 0.08% suggests limited exploitation in the wild despite the availability of detailed technical advisories.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability as documented in merge request https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch. For systems that cannot be immediately updated, consider implementing input validation for media files before processing with GStreamer, restricting the processing of untrusted QuickTime/MP4 files, or running GStreamer-based applications in sandboxed environments with limited memory access. Debian users should apply the security updates referenced in https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. Monitor the vendor security page at https://gstreamer.freedesktop.org/security/ for any additional guidance or updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the qtdemux_parse_svq3_stsd_data function within qtdemux.c when processing SVQ3 (Sorenson Video 3) codec data in QuickTime containers. This is a classic CWE-125 out-of-bounds read where the seqh_size parameter is read from untrusted input without proper bounds checking before being used in a memcpy operation via gst_buffer_fill. The FOURCC_SMI_ case handler fails to validate that sufficient data remains in the buffer before attempting to read seqh_size bytes, potentially accessing memory beyond the allocated buffer boundaries.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validation. If seqh_size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47596, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB